4^^531 623171 US 



U.S. Express Mail Label N^^531623171US 

PATENT 
Docket No: 036258.0207 

PATENT APPLICATION IN THE U.S. PATENT AND TRADEMARK OFFICE 

FOR 

METHOD AND SYSTEM FOR THIRD PARTY RESOURCE 
PROVISIONING MANAGEMENT 

BY 



10 



CI 



JEFFREY C. CURIE 
KAI MILDENBERGER 
FRANK YEH, JR. 



Background 



1 . Field of the Invention 

The present invention relates, generally, to resource provisioning management 
15 (RPM) systems, and, in preferred embodiments, to third party providers of resource 
I provisioning management services. 



2. Description of Related Art 

A common use of communication networks is to provide users access to 
network resources such as software, electronic data, or files in storage systems or databases 
20 connected to the network. As the number of users on a given network increases, there is often 
a need to control user access rights to resources on the network. However, as the number and 
/5\ type of resources available over the network increase, the difficulty in managing/access-rights- 



to such resources tends to increase. Further difficulties arise where resources are in remote 
locations, accessible to users over a distributed network, such as the Internet. 
25 Network environments often involve a variety of network users, where the users 

may be grouped or categorized by a relation or role that the user serves in the environment. 
For example, in an engineering or technical development company environment, users of the 
company's computer network may include company officers, directors, managers, engineers, 
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technical support staff, office support staff, accounting department staff, information 
technology (IT) department staff, contractors, consulta nts, temporary employees or other 
relation-based or role-based groups or categories of network usms. Other companies, 



organizations or network environments may have other relation or role-based groups of users. 



5 Eaeh-user-may-have-a need toaccess-eertai n net workTesources in connection with the user's 



relation or role. In addition, it may be desirable restric Tusers^ith certain relations or roles 
from access to certain resources, for example, for security, privacy or other reasons. 

Depending on the network environment, other types of resources may also be 
allocated to (or restricted from) users, based on the user's relation or role in the environment. 

10 For example, in the engineering or development company environment described above, users 
may be allocated such resources as telephones, telephone accounts, computers, Internet 
accounts, e-mail accounts, office equipment and supplies, laboratory or engineering equipment 
and supplies, or other resources, based on the user's role or relation with the company. 

In many conventional businesses or organizations, specific personnel perform 

15 the function of provisioning users according to their roles. For example, an office 
administrator may place an order with the organization's information technology (IT) 
department to have a computer, telephone, voice mail, e-mail, and certain applications and 
databases available on the day a new user joins the organization. Individuals from the IT 
department would then manually set up these resources. Other office personnel may bring 

20 desks, chairs, and cabinets from storage and set up the user's office. Over the course of time, 
the user's relationship or roles within the organization may change, for example, as the user is 
transferred, promoted, demoted or terminated from the organization. As a user's relationship 
or role with the organization changes, the user's needs or rights to access resources may 
change. 

25 Thg jburden on the office administrator and office personnel to manually 

administer user jiccess to resources in the above example is typically dependent on the, size of 

^ the or ganization (the number of users) and the rate at which users join drTeave^the 

organization or otherwise change roles. To improve efficiency and reduce the burden on the 
office administrator and office personnel, some organizations have used software applications 



.472852.3 



PATENT 
Docket No: 036258.0207 



3 - 



which automate or partially automate some of the tasks relating to provisioning certain, limited 
types of resources tcuisers: 



^Role-Based-Access Control (RBAC) is onejform of automatic provisioning that 



10 



15 




has become commercially available. RBAC provides permissions (access rights) to a user to 
access certain accounts (files, web pages, etc.) available over the network, based on a person's 
role in the organization. For example, a file or folder may be viewed only by its creator, or 
may be accessible to a larger group of users through an organization's network, depending on 
the permission rights established for that file or folder. In conventional RBAC systems, these 
permissions are based on a person's role within the organization. 

However, modern organizations may be structured along several intersecting 
lines. For example, organizations may be structured according to title (presidents, vice- 
presidents, directors, managers, supervisors, etc.), technology (electronics, mechanical, 
software, etc.), project (product A, B, C, etc.), location (Irvine, New York, etc.) and the like. 
A single user may appear in several or all of these organizational structures, and thus may be 
in a somewhat unique overall role as compared to other users in the organization. Because 
this may require that many users be provisioned uniquely, many unique roles would have to be 
defined in the system to automate such provisioning. J^herrr^ 

provisions "soft" resources such as accounts, applications , jiatahas.es;, .files ,Jfeh pages, and 



the like, as opposed to "h^jd"„resources-such-^ desks, and the like. 

The software applications which automate or partially automate some of the 



tasks relating to provisioning certain, limited types of resources to users are o perable o n a 



communication network fQiLp ravisionm giise^^ according to established criteria. 

Systems employing such software applications will be generally referred to herein as RPM 
systems. 

25 Although the third party service providers or managed services (collectively 

known as managed resources) may have user management consoles which enable a human to 
make changes to the managed resource, the consoles or interfaces may be incompatible with 
the RPM system. Because of this, software agents may be deployed as translators between the 
RPM system and the managed resources. The agent, in essence, replaces human intervention 

30 with automated steps that perform essentially the same function. The agent is capable of 
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receiving a message or request from the RPM system, and translating the request to code that 
can interface with the Application Programming Interfaces (APIs) of the managed resource. 
After the managed resource performs the particular function of the request, the managed 
resource may pass values to the agent, which may then communicate the values back to the 
5 RPM system. 

Unfortunately, the implementation of an RPM system may require resources 
that are cost-prohibitive for some companies or organizations. Implementation of an RPM 
system typically requires system servers, terminals, system software, agents and other items 
associated with a communications network. Expenditures for such items can be tremendous, 
10 costing anywhere from tens of thousands to hundreds of thousands of dollars. These costs 
may be overwhelming for companies or organizations of modest means, thereby putting 

.IKS. 

acquisition and implementation of an RPM system out of reach. 

31 Also, the implementation of an RPM system typically requires a commitment to 

in 

□ personnel for the operation of the system. The cost required to hire and train such personnel 

^\ 

'T % 15 and the costs for associated overhead may discourage some companies or organizations from 

"'s~ S 

■3i implementing an RPM system altogether. Thus, without a viable alternative for RPM 

Cj services, these companies and organizations cannot benefit from an RPM system. 
%\ Companies and other organizations who lack the resources for or who are 

J 3f otherwise discouraged from acquiring and implementing an RPM system could benefit greatly 
u 20 from third parties who function as providers of RPM services. Up until now, however, a 
system and method for providing third party RPM services has not existed. Generally, an 
RPM system and method has heretofore been implemented within an organization utilizing 
resources in an enterprise or application service provider environment. 

Tremendous benefit could also be obtained by companies and other 
25 organizations utilizing third party RPM service providers if the resources being provisioned 
could be shared among such companies or organizations. Such sharing among affiliated 
companies could provide cost savings and administrative efficiency. Again, however, up until 
now, a mechanism for sharing resources among affiliate companies or organizations utilizing 
third party RPM service providers has not existed. 



PATENT 
Docket No: 036258.0207 



015.472852.3 




PATENT 
Docket No: 036258.0207 



-5- 

A need also exists for a public infrastructure generally in the RPM sector. 
There does not currently exist any third party RPM service provider delivering provisioning 
services such as identity, entitlement, policies and roles for the general public to utilize when 
the need for resource provisioning arises. 

Summary 

Therefore, embodiments of the present invention relate to systems and methods 
for provisioning resources of a plurality of organizations using a single logical server, where 
each organization may have internal resources. 

Such a method may comprise the steps of establishing a set of attributes, 
organizational information, and user roles for each organization; defining a plurality of 
resource provisioning policies for each organization based on selected attributes, 
organizational information, and user roles; receiving attribute information, organizational 
information, and user role information from each organization for a particular user, resource, 
or database; determining which resource provisioning policies are applicable to the user based 
on the received user role information, organizational information, and attribute information; 
and provisioning the user from a remote, centralized location with resources based on the 
applicable resource provisioning policies. 

The method may also include provisioning over a network and provisioning 
users with external resources. 

A method for provisioning resources of a plurality of organizations using a 
single logical server, each organization having internal resources may also comprise the steps 
of establishing a set of attributes, organizational information, and user roles for each 
organization; defining a plurality of resource provisioning policies for each organization based 
on selected attributes, organizational information, and user roles; receiving attribute 
information, organizational information, and user role information from each organization for 
a particular user, resource, or database; determining which resource provisioning policies are 
applicable to users based on the received user role information, organizational information, 
and attribute information; grouping each organization together into a resource exchange; and 
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cross-provisioning users from a remote, centralized location with resources from organizations 

within the resource exchange based on the applicable resource provisioning policies. 

The method may also include the step of providing a translational map for 

organizations within the resource exchange. Further, the method may include the step of 
5 providing high level authentication of organizations within the resource exchange. The 

method may further include the step of providing identity synchronization of organizations 

within the resource exchange. The method may further include the step of providing an audit 

trail for organizations within the resource exchange, and may further include the step of 

providing anonymity for organizations within the resource exchange. 
10 A method for provisioning resources of a plurality of organizations using a 

server in a public provision infrastructure may also comprise the steps of establishing a set of 
4j attributes, organizational information, and user roles for each organization having resources; 
31 defining a plurality of resource provisioning policies for each organization having resources 
O based on selected attributes, organizational information, and user roles; receiving attribute 
r£ 15 information, organizational information, and user role information from each organization for 

a particular user, resource, or database; receiving attribute information, organizational 
q information, and user role information from members of a general public desiring use of a 
;S{ resource within the public provisioning infrastructure; generating a resource provisioning 
f 1 ticket for the members of the general public; determining which resource provisioning 
U 20 policies are applicable to users based on the received user role information, organizational 

information, and attribute information; and forwarding the provisioning ticket to a vendor of a 

particular resource. 

A system for provisioning resources of a plurality of organizations may 

comprise a third party resource provisioning management service provider; a server for 
25 provisioning resources, wherein the server is operated by a third party resource provisioning 

management service provider; internal resources belonging to each organization; and a 

network providing a link between the server and the internal resources; wherein the third party 

resource provisioning management service provider provisions the internal resources of each 

organization over the network at the request of the organization. 
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The system may further comprise external resources, wherein the external 
resources are provisioned for each organization. 

A system for provisioning resources of a plurality of organizations may also 
comprise a third party resource provisioning management service provider; a server for 
5 provisioning resources, wherein the server is operated by a third party resource provisioning 
management service provider; a resource exchange made up of the plurality of organizations, 
each organization having internal resources; and a network providing a link between the server 
and the internal resources, wherein the third party resource provisioning management service 
provider cross-provisions the internal resources of each organization within the resource 
10 exchange over the network at the request of each organization. 

The system may further comprise a translational map for organizations within 
m the resource exchange, means for each high level authentication of organizations within the 
ill resource exchange, means for identity synchronization of organizations within the resource 
rj exchange, and means for providing an audit trail for organizations within the resource 
15 exchange. 

'"■£,4 

Sj A system for provisioning resources of a plurality of organizations may also 

q comprise means for establishing a set of attributes, organizational information, and user roles 
'it for each organization having resources; means for defining a plurality of resource provisioning 
3? policies for each organization having resources based on selected attributes, organizational 
CI 20 information, and user roles; means for receiving attribute information, organizational 

information, and user role information from each organization for a particular user, resource, 
or database; means for receiving attribute information, organizational information, and user 
role information from members of a general public desiring use of a resource within the public 
provisioning infrastructure; means for generating a resource provisioning ticket for the 
25 members of the general public; means for determining which resource provisioning policies 
are applicable to users based on the received user role information, organizational information, 
and attribute information; and means for forwarding the provisioning ticket to a vendor of a 
particular resource. 
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These and other objects, features, and advantages of embodiments of the 
invention will be apparent to those skilled in the art from the following detailed description of 
embodiments of the invention, when read with the drawings and appended claims. 



Brief Description of the Drawings 

5 FIG. 1 is a diagram of an external view of an Application Service Provider 

(ASP) environment embodiment of the present invention. 

FIG. 2 is a diagram of an external view of a Corporate Enterprise environment 
embodiment of the present invention. 

FIG. 3 is a diagram of logical architecture of a system according to an 
10 embodiment of the present invention. 

FIG. 4 is a diagram of a component arrangement of a system according to an 
embodiment of the present invention. 

FIG. 5 is a diagram of an example deployment of a system according to an 
embodiment of the present invention. 
15 FIG. 6 is a diagram of another example deployment of a system according to an 

embodiment of the present invention. 

FIGS. 7A-E are sequence diagrams of interactions relating to authenticating a 
□ user, adding a user, provisioning a service for a user, provisioning services for a new user 
based on policy, and synchronizing services and enforcing policy violations. 
20 FIG. 8 is diagram of graphical interfaces in a sequence relating to a 

provisioning process. 

FIG. 9 is a diagram of a generalized architecture of a resource provisioning 
management system according to an embodiment of the present invention 

FIG. 10 is a diagram of a resource provisioning management system utilizing a 
25 centralized server according to an embodiment of the present invention. 

FIG. 11A is a flow diagram of resource provisioning management using a 
centralized server according to an embodiment of the present invention. 



.y s 
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FIG. 1 IB is another flow diagram of resource provisioning management using a 
centralized server according to an embodiment of the present invention. 

FIG. 12 is a diagram of a resource provisioning management system utilizing a 
centralized server and external resources according to an embodiment of the present invention. 
5 FIG. 13 is a diagram of a resource provisioning management system utilizing a 

centralized server providing cross-provision of affiliate resources in a resource exchange 
according to an embodiment of the present invention. 

FIG. 14A is a flow diagram of a resource provisioning management method 
utilizing a centralized server providing cross-provisioning of affiliate resources in a resource 
10 exchange according to an embodiment of the present invention. 

FIG. 14B is another flow diagram of a resource provisioning management 
method utilizing a centralized server providing cross-provisioning of affiliate resources in a 
resource exchange according to an embodiment of the present invention. 

FIG. 15 is a diagram of a resource provisioning management system utilizing a 
15 centralized server providing a public provisioning infrastructure according to an embodiment 
of the present invention. 

FIG. 16 is a flow diagram of a resource provisioning management method 
utilizing a centralized server providing a public provisioning infrastructure according to an 
embodiment of the present invention. 
20 FIG. 17 is a diagram of various levels of a resource provisioning management 

system utilizing a centralized server according to an embodiment of the present invention. 

Detailed Description of Preferred Embodiments 

In the following description of preferred embodiments, reference is made to the 
25 accompanying drawings which form a part hereof, and in which is shown by way of 
illustration specific embodiments in which the invention may be practiced. It is to be 
understood that other embodiments may be utilized and structural changes may be made 
without departing from the scope of the preferred embodiments of the present invention. 

.472852.3 
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System Overview 

As described above, embodiments of the present invention relate to a system 
operable on a communication network for provisioning users with resources based on policies, 
roles and attributes. Embodiments of the present invention will be generally referred to herein 
5 as a resource provisioning management (RPM) system, or simply "the system. " 

The system may be implemented with software applications and modules 
deployed on various processor or computer systems connected for communication over one or 
more network or non-network links. As described in more detail below, the processors in 
which the modules and applications are deployed may differ from system embodiment to 
10 system embodiment. In addition, the types of users, administrators and other entities that 
interact with the system may differ from system embodiment to system embodiment. 
Preferred embodiments of the system are designed to provide a high level of flexibility to 
accommodate the needs of a variety of potential applications of use. 

Two representative examples of system environments in which embodiments of 



„ 15 the present invention operate are shown in FIGS. 1 and 2, respectively. FIG. 1 shows a 

generalized representation of an Application Service Provider (ASP) environment 
q embodiment, while FIG. 2 shows ai generalized representation of an Enterprise environment 

embodiment of the system. In each of FIGS. 1 and 2, a platform computer system 10 is 
3j coupled for communication with a plurality of user computers, administrator computers and 
M 20 other entities over a network 12, depending upon the needs of the system. Further entities, 
including external systems, databases and directories, third party service providers, managed 
services and system administrators may be coupled for communication to the platform system 
10 through the same network or through other networks or dedicated communication links, 
depending upon the needs of the system. While a number of such entities are shown and 
25 described with respect to embodiments disclosed herein, it will be understood that further 

system environment embodiments of the invention need not include all of the entities described 
herein. 

The network environment may also include one or more network servers, 
routers and other network structure and devices (not shown). A network environment may 
30 comprise a local area network (LAN), for example, within an office or building. In other 
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embodiments, the network environment may comprise a wide area network (WAN) including, 
but not limited to, the Internet. 

The platform system 10 may be implemented, for example, with one or more 
processors or computers which include or operate with associated memory and software 
5 modules and applications to carry out various functions described herein. The platform system 
10 carries out various functions associated with provisioning users with resources based on 
policies, roles, organizational information, and attributes, as described below. Further 
functions may be carried out on processors or computers associated with the users, 
administrators, and service providers, for example, implemented by software running on those 
10 computers, as described below. Embodiments of the present invention can therefore run on a 
cluster of computers or on a single computer. These computers may or may not have multiple 
□ processors. 

□J Users, and users acting in administrator roles, may operate computers which 

I E 

?5 may include suitable processors, memory devices and user interface devices, such as, but not 
j ~f 15 limited to, display devices, keyboards, mouse devices, or the like, to allow users to obtain and 
ill communicate information over the network or other communication link. Suitable software 
p may be stored at, or be accessible to, the user and administrator Web browsers or computers, 
:*{ to provide user and administrator interface functions and to allow communication of electronic 
ill information and content, such as data, files, programs and other software over the network, in 

Ci 20 accordance with well known network communication technology. In addition, software for 
implementing functions associated with the user and administrator according to embodiments 
of the present invention may also be stored at, or be accessible to, the user and administrator 
Web browsers, respectively. 

The system 10 provides a platform for defining policies and provisioning 
25 services to a user interacting with the system, or a user interacting with the network on which 
the system is operating. The system may designate and track the types of services as well as 
the types of access to these services for a large number of users. In the generalized examples 
of FIGS. 1 and 2, the platform system 10 may receive requests for services from user 
computers. The platform system 10 may also receive information from administrator 
30 computers relating to, for example, authorizations of users' requests or changes in users, 
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policies or roles. The platform system 10 may also provide information to the administrator 
Web browsers or computers, including, for example, reports on operation and service usage. 
The platform system 10 may provide requests, instructions, or other information to service 
providers or managed services computers related to providing services to the users, based on 
5 user requests, policies, roles, organizational information, and attributes. The platform system 
10 may control access to services, such as data, files, programs or other electronic information 
from database or storage systems to the users, based on user requests, policies, roles, 
organizational information, and attributes. 

As described above, a system according to the FIG. 1 embodiment is deployed 
10 in an ASP environment. An ASP may be described as an organization that deploys, hosts and 
manages access to applications such as software and other resources to multiple parties from a 
centrally managed facility. The applications are typically delivered over networks, including, 
83 but not limited to the Internet, on a subscription basis. 

In the ASP environment, one or more users within the ASP may be designated 
^? 15 as RPM system administrators 14 with access rights greater than other users at the same 
fll company. RPM system administrators, like other users at the same company, are capable of 

Is 

ri performing operations in accordance with policies put in place by the ASP customer, which 
•t\ may be based on role and organizational information for each user. However, these RPM 
9 system administrators are additionally provided with certain system configuration 
U 20 responsibilities, including selecting the processors on which certain modules or applications of 
the system are deployed, as described below. In addition, an RPM system administrator may 
be able to manage, for example, organizations, users, services, roles, workflow rules, policies 
and the system itself. An RPM provisioning system administrator may also generate reports to 
audit the current and historical status of the system, and may also be authorized to manage 
25 different portions of the system 1 s data by being granted permission to access such data. The 
responsibilities of any given RPM system administrator may range from organization 
management only, to entire system management, depending upon the permission or access 
rights provided to the given RPM system administrator. 

The system in FIG. 1 may also interface, for example, with one or more 
30 Customer End-Users 16, Customer Administrators 18, and Customer Supervisors 20. In the 
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illustrated example, the interfaces for the Customer End-User 16, Customer Administrator 18, 
and Customer Supervisor 20 are Web enabled for connection over the Internet 12. 

A Customer End-User 16 is a user having access to resources in accordance 
with policies put in place by the customer A Customer End-User 16 may be an employee of 
5 an ASP's customer who is provided access to certain ASP resources. A Customer End-User 
16 would typically be authorized only to perform self-administration of its own personal and 
account information stored in a Lightweight Directory Access Protocol (LDAP) Directory 
server (not shown in FIG. 1) by communicating requests for provisioned services/resources 
over the network using a Web browser. 
10 A Customer Administrator 18, as shown in FIG. 1, is also a user having access 

to resources in accordance with policies put in place by the customer. A Customer 
Administrator 18 may be an employee of an ASP's customer who is responsible for 

•II 

Ql administering portions of a customer's organization, such as managing organizational and user 
£1 information and, is therefore provided with permissions or access rights to appropriate system 
]~t 15 data to perform such functions. For example, a Customer Administrator may define and 
>31 manage use of user roles and policies and, thus, may be provided with permission or access 
£3 rights to the LDAP Directory Server.. Thus, a Customer Administrator may define or change 

1 - I - _ _ _ 

Iff users, roles, policies, organization hierarchy or the like. A Customer Administrator may also 
■3* generate reports to audit the current and historical status of the system, and therefore may be 
Q 20 provided with permission or access rights to the RPM system server containing a report engine 
150 (see FIG. 3). A Customer Administrator 18 typically would be authorized to manage 
different portions of the system's data by being granted permission to access such data. The 
responsibilities of a Customer Administrator 18 may range from organization management 
only, to entire system management, depending upon the permission rights granted to the 
25 Customer Administrator. 

A Customer Supervisor 20, as shown in FIG. 1, is also a user having access to 
resources in accordance with policies put in place by the customer. A Customer Supervisor 20 
may be an employee of an ASP's customer who is responsible for managing or supervising 
groups of users in the customer organization. A Customer Supervisor 20 may delegate 
30 responsibilities to another Customer Supervisor. In preferred embodiments, the delegation of 

015.472852.3 
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responsibility may be authorized for a pre-defined period of time. A Customer Supervisor 20 
may make changes to a roster of current users and approve requests made by users, where 
such requests require approval. A Customer Supervisor 20 may also generate reports to audit 
the current and historical status of the system. It should be understood that, in preferred 
5 embodiments, reports are not stored. Rather, they are generated as needed, and if a user 
wants to store a report, it would have to be saved to the user's Web browser. 

FIG. 1 also indicates that the system may interface with one or more External 
Systems 22. An External System 22 may be any ASP system that may wish to retrieve 
customer or managed resource information that is managed by the system 10. This may be 
10 accomplished via a direct interface to an RPM directory (see reference character 58 in FIG. 3) 
used by the system 10 to store such information. 
~! As illustrated in FIG. 1, the system may also interface with one or more 

01 Customer Datastores 24. In preferred embodiments, this interface is Internet capable. A 

Cl 

Customer Datastore 24 may be a relational database or directory that stores ASP customer 
15 information. Note that customer-relevant data such as the customer's organization, roles, 
3^ account information, and user information is stored in the directories within the Customer 
□ Datastores 24, while in-progress workflow information, audit logs, historical audit trail 
%\ information (e.g., requests that have been approved), system state information (e.g. workflow 
^ ] state, requests that have not yet been approved), and information about remote services is 
|»b 20 stored in the databases within the Customer Datastores 24. 

The system 10 may also interface, for example, with a Managed Service 26, as 
shown in FIG. 1. In preferred embodiments, this interface is Internet capable. A Managed 
Service 26 may be an application, device or datastore that the system 10 proactively manages. 
A Managed Service may comprise a network device that has an account maintenance system, 
25 such as an RPM system, an operating system, an application (e.g., a human resources (HR) 
system, enterprise resource planning (ERP) system, etc.), public key infrastructure (PKI) 
certificates, databases, financial services, and the like. The Managed Service's system may 
function independently. Thus, the datastore for the system 10 and that of a Managed Service 
may be synchronized periodically or at defined or irregular intervals, for example, to update 
30 the datastore. 
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The system may also interface, for example, with a Third Party Service 
Provider 28, as shown in FIG. 1. In preferred embodiments, this interface is Internet capable. 
A Third Party Service Provider 28 may be an external organization that provides services that 
may be provisioned through the system 10. A Third Party Service Provider 28 may be, for 
5 example, a credit card service that provides credit cards or credit accounts that are provisioned 
through the system 10. As another example, a Third Party Service Provider 28 may be a 
telephone service company that provides telephone line accounts that are provisioned through 
the system 10. It should be understood that these are merely representative examples. Many 
other types of services may be provided by a Third Party Service Provider in accordance with 
10 further system embodiments. 

The system 10 may also interface, for example, with a Partner System 30, as 
shown in FIG. L In preferred embodiments, this interface is Internet capable. A Partner 
ill System 30 may be similar or identical to the system 10, but used by a business partner or 
r*s customer and integrated into the system 10. Thus, the Partner System 30 represents a system- 
J** 15 to-system interface which, in preferred embodiments, may be used to provide the seamless 
Ql integration of multiple systems. 

jr% As described above, a system according to the embodiment of FIG. 2 is 

%\ deployed in an Enterprise environment. An enterprise may be any organization that desires or 

3} requires management and administration of its resources, including, but not limited to, . 

:~ s 

20 companies, firms, educational organizations, governmental organizations, or other groups or 
associations. In the FIG. 2 embodiment, the system 10 supports the same capabilities 
described above with respect to FIG. 1, but with some differences for different kinds of users. 

For example, the system 10 may interface with a System Administrator 50 in a 
manner similar to the RPM system administrator interface described with respect to FIG. 1. 

25 The System Administrator 50 may be an employee of the Enterprise, and may have 

responsibility for configuring the system. A System Administrator 50 may be able to manage 
organizations, users, services, roles, workflow rules, policies, and the system itself. A 
System Administrator 50 may also generate reports to audit the current and historical status of 
the system. A System Administrator 50 may be authorized to manage different portions of the 

30 system's data by being granted permission to access such data. The responsibilities of a 
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System Administrator 50 may range from organization management only, to entire system 
management. 

Instead of Customer End-Users, Customer Administrators and Customer 
Supervisors described with respect to FIG. 1, the environment in FIG. 2 includes Employees 
5 (or Partners) 52, Employee Administrators 54, and Supervisors 56. Each may interface with 
the system 10, and are preferably web enabled for interfacing with system 10 over the 
Internet. An Employee may be an employee of the enterprise. An Employee 52 is a user 
having access to resources in accordance with policies put in place by the enterprise. 
Typically, an Employee may only be authorized to perform self-administration of the 
10 Employee's own personal information. 

An Employee Administrator 54, as shown in FIG. 2, may be an employee of 

c * the Enterprise who is responsible for Enterprise employee administration. An Employee 

■mi 

□j Administrator 54 is a user having access to resources in accordance with policies put in place 

by the Enterprise, who is responsible for managing the Enterprise's organizational and user 
4 1 15 information. This may involve defining, changing and managing user roles and policies. An 
Qj Employee Administrator 54 may also generate reports to audit the current and historical status 
i:l of the system. An Employee Administrator 54 may be authorized to manage different portions 
■it of the system's data by being granted permission to access such data. The responsibilities of 
an Employee Administrator 54 may range from organization management only, to entire 

Q 

Cl 20 system management. 

An Enterprise Supervisor 56 may be an employee of the Enterprise who is 
responsible for managing groups of users within the Enterprise. Typically, an Enterprise 
Supervisor 56 may make changes to users and approve requests made by users. An Enterprise 
Supervisor 56 may also generate reports to audit the current and historical status of the system. 
25 FIG. 2 also indicates that the system may interface with a Directory 58. A 

Directory 58 may be used by the system to store organizational information, user or employee 
information, partner information, role information, account information, resource information 
or the like. In one embodiment, the Directory is an LDAPv3 directory. The directory may be 
supplied by an Enterprise customer, or may be installed solely for the system 10. 
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As illustrated in FIG. 2, the system may interface with a Human Resources 
Datastore 60. A Human Resources Datastore 60 may be a database or directory that stores 
Enterprise employee and partner information. 

The system 10 may also interface with a Partner System 62, Third Party Service 
5 Providers 64 and Managed Services 66, in a manner similar to that described above with 

respect to the Partner Systems 30, Third Party Service Providers 28 and Managed Services 26 
in FIG. 1. 

The system 10 in FIGS. 1 and 2 may be used to manage the provisioning of a 
variety of services or resources to users. A service may be any type of resource that may be 
10 accessed one or more times by users of the system. For example, a cellular telephone account 
or an account with a credit card company may be services. Using these services as examples, 
-£? the system may, for example, designate that certain users have access to a cellular telephone 
;5! account and a credit card account, and may track the usage by the user of these accounts. The 
system may also set various rules and policies regarding the use of these accounts by the user, 
~: 15 depending on the status of the user. 

□I Using the system, an organization may provision, or allocate, services to a user 

Is 

£1 within the organization based on defined policies, organizational information, attributes, and 
•% j the role of the user in the organization. The policies, or rules, may be pre-defined for the 
yl organization based on the needs of the organization and incorporated into the system. The 
20 policies may be flexible enough to account for the various roles within the organization and the 
services each role requires. For example, assume an organization hires a new employee in the 
capacity of System Administrator. Using the system, several actions may be automatically 
initiated. For example, if a pre-set policy for the organization provides that each employee 
receives regular telephone service, a regular telephone, and an e-mail account, then upon the 
25 hiring of a new System Administrator, the system will automatically notify the appropriate 
parties to set up a regular telephone account and an e-mail account for the System 
Administrator and deliver a regular telephone to the System Administrator's office. Assume 
also that a pre-set policy for the organization is that each System Administrator has access to 
all system databases. The system will then automatically grant the System Administrator 
30 access to all system databases. 
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For purposes of illustration only, assume that the same organization hires a new 
employee in the capacity of Outside Salesperson. As before, because of the policies that have 
been pre-defined for the organization, including, but not limited to, the policy that each 
employee receives regular telephone service, a regular telephone, and an e-mail account, the 
5 system automatically notifies the appropriate parties to set up a regular telephone account and 
an e-mail account for the Outside Salesperson and deliver a regular telephone to the Outside 
Salesperson's office. However, if the organization has a pre-defined policy that Outside 
Salespersons do not have access to all system databases, as do System Administrators, then 
access to these databases may be automatically denied by the system to the Outside 
10 Salesperson. If, however, the organization has a pre-defined policy that all Outside 

Salespersons receive cellular telephones, then the system may automatically set up a cellular 

j »f telephone account for and order delivery of a cellular telephone to the Outside Salesperson. 

4) 

y| Preferred embodiments of the system described herein perform these actions 

automatically based on the role of the person within th9 organization and policies that are pre- 
15 defined for the organization. The policies may be based on the needs of the organization and 
01 the requirements of each particular role within the organization, such that resources may be 
?\ provisioned to each user to meet the needs and the requirements of the user's particular role in 
the organization. 

'zf - 

T[ System Logical Architecture 

20 A logical architecture view of applications and modules of a system 10 

according to one embodiment of the present invention is shown in FIG. 3. As shown in FIG. 
3, an example system embodiment may be characterized as a group of software modules with 
interfaces that allow the modules to collaborate with each other in order to implement the 
features of the system. In preferred embodiments, each module may be a self-contained unit 
25 of software that may be replaced within the system without compromising the integrity of the 
system, as long as the interface of the replaced module is maintained. While the interface to 
the module may remain consistent, the internal architecture of each module may vary, 
depending upon the application of use. 
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The modules may be grouped into an applications subsystem 102 and a platform 
subsystem 104. The applications subsystem 102 is directed toward applications that help a 
user or an administrator perform specific functions and, thus, may be implemented in software 
running on computers operated by users or administrators. The platform subsystem is directed 
5 toward services and utilities for enabling applications to interact with directories and databases 
containing the state of a network and the services on that network that are being managed. 
The platform subsystem may be implemented in software running on the platform computer 
system. 

The applications subsystem 102 may include, for example, administration 
10 applications 106, application framework 108 and user applications 110. Administration 
applications 106 are applications used by an administrator, via the network, for various 
administration purposes. These applications may include one or more System Configuration 
applications 112, which provide an interface to allow an administrator to configure certain 
properties of the system. For example, the administrator interface may allow administrators to 
15 make system configuration settings, including, but not limited to, directory communication 
settings, logging properties, e-mail service settings, and garbage collection settings. The 
System Configuration applications 112 may include an interface to a Form Generation 
application 1 14, invoked to provide custom forms for data managed by the system. An 
3* example of such a form is illustrated in FIG. 8. 

20 The Form Generation application 114 may also allow an administrator to create 

custom forms to be displayed in user and administrator applications. The Form Generation 
application may comprise a graphical user interface builder that associates system data 
attributes with graphical controls, which may include, but is not limited to, a "What You See 
Is What You Get" (WYSIWYG) graphical user interface builder. 
25 The administration applications 106 may also include one or more Service 

Configuration applications 116, which provide an interface to allow administrators to 
configure certain properties of a service managed by the system. Examples of properties of a 
managed service include, but are not limited to, network location (IP address and port 
number), encryption for use and management, administrator login (ID and password), and 
30 management protocols. 
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In one preferred embodiment, a service may be bundled as a set with other 
services that are related through administrator-defined dependencies defined through the 
administrator interface. The Service Configuration applications 116 may include an interface 
to the Form Generation application 114 to provide custom forms for the account information 
5 to be used in the User Management web user application, which is the Web-based user 
interface that allows a user to add, modify, and delete other users. 

The application framework 108 comprises a framework that integrates 
administrator and user applications. The application framework may include one or more 
System Browser applications 118, accessible by the system administrator, that preferably 
10 provide a graphical display of the entire managed contents of the system in a format that is 
easy to use. 

£f The user applications 1 10 are applications used by an end-user, over the 

ill network, for various purposes. The user applications 110 may include one or more 

^ Organization Management applications 120 that preferably provide a graphical display of an 

|=( 15 organization's hierarchy of data in a format that is easy to use. From this interface, 

■91 organizational units, locations, business partner organizations, users, system roles and 

o organizational roles in the form of a tree view can be constructed and altered. 

Hi Depending upon die access level of the user, different areas of the hierarchy can - - - 

3s be viewed or modified by the user. In embodiments in which the system manages multiple 

;— i 

|I = 20 organizations, a user in a given organization will be restricted from accessing other 

organizations' data. However, a system administrator (not to be confused with an employee 
administrator or a customer administrator, described below) may be provided with access 
rights to all organizations' data. 

The user applications 1 10 may include one or more Request Management 
25 applications 122 that provide an interface for the user to review and manage change requests 
pending within the system. A change request is a request to change one or more attributes of 
a user, or a request to change one or more attributes of a service belonging to that user. The 
interface may allow, for example, users acting in a supervisory role to approve or disapprove 
change requests. 
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The user applications 1 10 may also include one or more Form Viewer 
applications 124 that dynamically display forms as they are designed by the Form Generation 
administration application 114. The access level of the user determines which form, if any, 
the Form Viewer application will display in different situations. One or more Report Viewer 
5 applications 126 may be included for allowing a user to instruct a Report Engine in the 
platform subsystem 104 to execute predefined reports, and for displaying the results to the 
user. The access level of the user determines which reports the Report Viewer will provide. 
In addition, the user applications include applications for allowing a user to submit a request 
for provisioned services. 
10 The user applications 110 may also include a Policy Management application 

128 that provides an interface for defining policies that control the provisioning of services to 
users. In addition, constraints on individual attributes of services may be defined. The 
■GJ policies determine an association between the users and the services or resources, and 

constraints on those services provisioned to the users, based on attributes and user roles. The 
i 15 policies may define one or a series of approvals that are required before provisioning a given 
j 5- service or any service to a user. For example, such approvals may be required from one or 

r) more other users acting in a supervisory role. Policies may require one or more approvals if 
an attribute constraint is violated. The approvals may be defined using a Workflow 
Management application 130, which provides an interface for defining the approval process 
20 needed for a request in the system. 

As described above, the platform subsystem 104 includes service and utility 
modules that enable various applications of the system to interact with directories and 
databases that hold information relating to the state of the system and services available over 
the network. The platform subsystem 104 may include, for example, application services 132, 
25 data services 134 and remote services 136. In preferred embodiments, the platform modules 
are designed to be as independent as possible of any domain-specific information. This 
enables the platform to be easily applied to a different domain and support a new set of 
applications without (or with minimal) re-architecture. 

The application services 132 includes modules that may be used by several 
30 other system applications (client applications) to perform a service. These service modules 
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may provide a separate and independent set of capabilities to their client applications. The 
applications services modules 132 may include an Authorization module 138 for providing a 
set of authentication implementations that may be used by client applications. Such 
implementations may include, but are not limited to, simple password authentication 
5 techniques or X.509 certificate authentication. 

The application services 132 may also include an Authorization module 140 that 
provides an interface for authorized users to define authorization rules, and enforces those 
rules as client applications attempt operations on the system, such as requesting services or 
data. These rules may apply to accessing data within the system, as well as to operations that 
10 can be applied to the system data, such as add, modify, or delete operations. 

A Business-To-Business (B2B) Gateway module 142 may be included to provide 
an interface to an external access management system such as the RPM system described 
'm herein, or a comparable third-party system. 

j*j The B2B Gateway module 142 may provide an external system the ability to 

; s :: 15 add, modify, delete and query user information. In preferred embodiments, these functions 
91 may be performed through an open protocol such as, but not limited to, secure hypertext 
C j transport protocol (HTTPS) to enable secure communications through the Internet. In 
%{ preferred embodiments, requests made by external systems to carry out such functions may be 

0^ stored in an RPM database or other storage facility 144 for auditing purposes. 

Q 

u 20 The applications services 132 may also include a Logging module 146 that 

provides a utility for logging information, such. as alarms and historical events, into persistent 
storage (e.g. the RPM database 144) associated with the platform system. 

The applications services 132 may also include a Policy Engine 148 for 
executing policies that associate users with services. The Policy Engine 148 functions to 
25 determine whether or not provisioning requests conform to defined policies and to provide 

correct recovery procedures in the event that a policy is violated. If an approval is needed for 
a provisioning request, the Policy Engine 148 interfaces with a Workflow Engine 150 to notify 
and obtain authorization instructions from the appropriate authorization entity, which may be, 
for example, one or more users having pre-defined supervisory roles. 
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The Workflow Engine 150 functions to execute and track transactions within the 
system. Such transactions may include provisioning and de-provisioning of services, user 
status changes, and the approval process associated with a provisioning request in the system. 
In preferred embodiments, users with appropriate access levels may, through a client 
5 application, query the Workflow Engine for status information relating to a transaction (such 
as a provisioning request) being executed by the system. 

The applications services modules also include a Report Engine 152 for 
executing predefined reports and formatting requested information. Note that requests for 
reports will only come directly from users of the system or the system administrator. They 
10 will not come from other systems. 

The data services modules 136 includes modules that assist other modules in 
interacting with directories and databases that hold the network's state and the system's 
configuration. The data services modules 136 may include an Information Model 154 that 
provides a logical view of the data in persistent storage in a manner that is independent of the 
15 type of data source that holds the data. The model abstracts the details of the stored data into 
more usable constructs, such as Users, Groups and Services, by adding an object-oriented 
layer on top of the LDAP-based data model. The model may also provide an extendable 
interface to allow for customized attributes that correspond to these constructs. 

The data services modules 136 may also include a Meta-Data module 156 that 
20 provides an interface from which a client may discover the design of the directory schema. 
Meta-Data is data that defines the content of the actual data. This may be used by a client to 
manage the data in persistent storage with a dynamic approach. 

The remote services modules 134 provide interaction with external systems for 
provisioning and de-provisioning services. Synchronization of service information and user 
25 information, which is the process of making sure that the information stored on the remote 
service and the information stored in the RPM system match and is up to date, may also be 
performed by the remote services modules 134. 

The remote services modules 134 may include a Message Transformation 
module 158 that provides utilities for defining and executing conversions of messages such as 
30 add, modify, delete, and search from one format to another. This module handles message 
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formats, rather than delivery protocols. The actual protocols used are determined at run-time, 
and may include, but are not limited to, Remote Access Management Protocol (RAMP), 
Encrypted Socket Protocol (ESP), and Directory Access Markup Language over HTTPS 
(DAML/HTTPS). The message transformation module 158 transforms between the data 
5 format used in the LDAP directory and the format used on the external system. Both formats 
are key value pairs, but the names of the keys must be mapped as part of the conversion 
process. 

The remote services modules 134 may also include a Provisioning module 160 
for providing an abstraction layer for provisioning products and services through external 
10 systems. The abstraction layer hides the protocol being used from the provisioning system. 
The specific protocols used to perform the provisioning, such as those described above, are 
□ preferably isolated from the client of the module. In preferred embodiments, new 
fl i provisioning protocols may be added to the module without disrupting the module interface. 
S{ The remote services modules 134 also include a Synchronization module 162 

15 that retrieves service information from external systems to keep the service information stored 
iJi by the system up to date. In addition, the Synchronization module 162 may retrieve 
i«s organizational information, such as organizational unit and user information. The module is 
j ff preferably pre-set or configured to define the data needed, how to retrieve it, where to store it 
ill and how often to perform retrievals. The module may also define rules for resolving conflicts 
T- 20 between information retrieved from an external system and currently stored data. 

System Components 
An example component view embodiment of the system is shown in FIG. 4, 
wherein logical applications and modules of FIG. 3 are organized into system components. A 
component is a self-contained and independent software entity that can be deployed onto 
25 computer and networking hardware separately from other components within the system. In 
the FIG. 4 embodiment, applications and modules are arranged to form an Application Server 
component 202, a B2B Server component 204, a Service Server component 206, a 
Synchronization Server component 208, a Web Server component 210 and a Workflow Server 
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component 212. Each of these components is arranged in one of two domains, a trusted 
domain 214 and a demilitarized zone (DMZ) domain 216, relative to an untrusted domain 218. 

A DMZ is a computer network (or a single computer) that is protected from a 
company's internal network (the trusted domain), but is accessible from the internet. The 
5 DMZ domain 216 contains systems that are accessible from the internet, and can access the 
internal network (trusted domain). The DMZ domain 216 will not typically contain any 
sensitive data or critical systems. The DMZ domain 216 is created so that even if a hacker 
breaks into the DMZ, the hacker would still have to break into the internal network from the 
DMZ. Although every effort is made to protect the DMZ from hackers, a security breach in 

10 the DMZ should not result in the theft or corruption of data, or in the loss of a critical system. 
The trusted domain, which is the internal network, is considered much more sensitive. Any 
intrusion into the trusted domain is considered a serious breach of security. 

The Application Server component 202 is composed of modules for supporting 
users interacting with the system, for example, through the Web Server component 210. The 

15 Application Server component 202 is coupled to the Web Server component 210 and the 

Workflow Server through secure connections, such as secure remote method invocation (RMI) 
connections. The Application Server component 202 includes the authentication, 
authorization, report engine and logging modules of the application services 132 and data 
services modules 136 shown in FIG. 3. In preferred embodiments, the Application Server 

20 component also executes logic for the presentation of the Application Services modules, so that 
the Web Server component may remain as simple as possible. This also provides a security 
boundary for the Application modules. 

In preferred embodiments, each request to the Application Server (requests 
from users for provisioned services) is authenticated and authorized before it is executed. At 

25 this level, only proper system credentials may be sufficient for authentication, to determine 
whether a valid Web Server is making the request. However, by requiring authorization of 
the requesting user before any request is executed, the Web Server component may remain in 
an untrusted domain. 

The B2B Server component 204 is composed of modules for providing an 

30 interface to external systems such as another provisioning system of the type described herein, 
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or other third-party provisioning systems that may communicate requests to the platform 
system. 

In the illustrated embodiment, the B2B Server component 204 includes the B2B 
Gateway module 142 and an Authentication module (see reference character 138 in FIG. 3) for 

5 authenticating B2B requests. The interface may be provided using a secure network protocol, 
such as HTTPS, for encrypting data transfer and for authentication of requestors. In preferred 
embodiments, all requesters must be authenticated and authorized before requests can be 
fulfilled. The B2B Server component 204 is also coupled to the Workflow Server 212, 
preferably through a secure connection, such as a secure RMI connection. 

10 The Service Server component 206 is composed of modules for providing an 

interface to managed resources 26 and 66, and services that issue unsolicited notices or 

□ asynchronous provisioning confirmations to the system. The Service Server component 206 

4) 

ii| may be connected to managed services resources 26 and 66, through, for example, a 
>f DAML/HTTPS connection. In addition, the Service Server component 206 may be connected 
15 to databases, such as a customer database 24, and third party service provider systems 28 and 
iji 64, through suitable connections, which may comprise HTTPS connections or vendor-specific 
P connections. 

;ff The Service Server component 206 includes a Notification Gateway module 

Oi which provides receiving logic that interacts with the Synchronization and Provisioning 
20 modules of the Synchronization Server 208 and the Workflow Server 212 components, 

respectively, through secure connections such as secure RMI connections. The separation of 
the Notification Gateway module from the Synchronization and Provisioning modules provides 
a security boundary between untrusted and trusted domains. The protocols used may be 
specific to the managed entity. In preferred embodiments, all requestors must be authenticated 
25 and authorized before passing on information to any modules in the trusted domain. 

The Synchronization Server component 208 includes modules for periodically 
synchronizing service information between the service providers 28, 64 and a local data 
repository. The Synchronization Server component 208 is configured to adapt to the service 
provider's interfaces to extract desired information. The Synchronization Server component 
30 208 includes the synchronization and message transformation modules of the remote services 
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134, the authentication, authorization, and logging modules of the applications services 132, 
and the data services modules 136 shown in FIG. 3. 

The Web Server component 210 includes modules for providing users with a 
graphical interface. The Web Server component includes an Applications Presentation 
5 module, which creates Web pages for the end user, as well as the authentication module of the 
applications services module group 132. The Web Server component is connected to client 
systems 16, 52, for example, over an HTML/HTTPS connection. Preferably, all clients are 
authenticated when making requests to the system. For example, the Web Server may be 
configured to require password authentication, X. 509 certificate authentication, or both, when 
10 using HTTPS. 

The Workflow Server component 212 includes modules for provisioning and 
j «f de-provisioning services within the system. The Workflow Server component includes the 
m policy engine, workflow engine, logging, email, authentication and authorization modules of 
'%{ the applications services module group 132, as well as the data services modules 136 and the 
j ~f 15 provisioning and message transforming modules of the remote services module group 134. 
rn 

L Deployment of System Components 

W The components 202-212 of the FIG. 4 embodiment may be deployed in 

01 hardware (processor or computer systems) in a variety of manners. The components may be 
j": deployed on as few processors as possible, for example, to minimize system complexity and 

20 operational cost. Alternatively, some or all of the components may be separated and 

distributed to separate processors to maximize computing resources. Many of the modules and 
applications within components can also be distributed to further maximize computing 
capabilities. Furthermore, some or all of the components may be configured in clusters to 
take advantage of load balancing algorithms and fail-over capabilities. 
25 The responsibility of configuring the system deployment may be provided to a 

system administrator. Thus, applications, modules or components containing groups of 
applications or modules as described above may be provided to a system administrator, for 
example, in software form (such as on a computer readable storage medium), in hardware or 
firmware form (such as on circuit boards or cards to be installed in a computer system) or a 
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combination thereof. The system administrator may then develop a deployment strategy that 
meets the organization's performance and security needs and deploy the appropriate modules 
on appropriate hardware devices to fit the desired strategy. The system administrator may be 
free to deploy all of the components of the system on one processor or distribute clusters of 
5 each component in almost any combination, if desired. 

An example of simple deployment option is shown in FIG. 5, where the six 
components 202-212 of FIG. 4 are clustered onto one processor 302 comprising the Platform 
system. Thus, processor 302 represents a server running the provisioning system according to 
embodiments of the present invention described herein. The Platform Processor 302 is 
10 coupled to external systems and clients over the network 306, through a Web Server Load 
Balancer 308. One or more Data Server processors 304 may be coupled to the platform 
Cf processor 302 for deploying the RPM Directory and RPM Database. The Data Server 
"SJ processors 304 include a server running a relational database server and an LDAP directory 
-J server. The FIG. 5 embodiment demonstrates a simple deployment with a clustered 

15 deployment of servers that deploy all the components of the system. The load balancing 
□1 algorithms dictate which components are running on specific processors. This deployment 

□ embodiment, however, may present security risks because the components are not deployed on 
■f ( separate hardware in separate trusted domains, as described above, 
yl Another example of a deployment option is shown in FIG. 6. The FIG. 6 

20 deployment, while more complex than the deployment shown in FIG. 5, alleviates some of the 
security concerns associated with the FIG. 5 deployment. All components 210, 204 and 206 
shown in the DMZ domain in FIG. 4 that interface to external clients and systems via the 
Internet may be clustered on one or more dedicated Web Server processors 402 in FIG. 6 to 
create a boundary between untrusted and trusted domains, where the web client is in an 
25 untrusted domain and the rest of the system components are in a trusted domain. The 
Synchronization Server component 208 is deployed in a separate cluster, so that 
communication with the service providers can be configured independently of other clusters. 

In this manner, the interfaces to external clients and systems are isolated to one 
or more servers containing only those components of the system necessary for external 
30 interface. Other components of the system, including, but not limited to, those components 
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that must remain secure, may reside on servers that do not interface to external clients and 
servers. Thus, external users of the system whose trustworthiness has not been verified are 
isolated from secure portions of the system, and the integrity of secure portions of the system 
residing on other servers within the system may be protected. 

5 System Functional Areas 

Now that the general system and various perspective views of the system have 
been described, including some examples of environments in which the system may operate, it 
may be understood that features of the system may be organized into functional areas. Some 
functional areas that may be incorporated into the system are given below and are merely 
10 examples of the types of functional areas the system may employ. 

□ For example, all requirements for defining approval signatures and enforcing 
them may be grouped into an Approval Management functional area. As another example, an 

Izi Authentication and Authorization functional area may group all requirements for user 

□ authentication to the system and the management of a user's access to functions and data 
0] 15 within the system. 

■L % As further examples of functional areas of the system, a Business Partner 

! f f functional area may group all requirements for managing business partner relationships. A 
oi Business-to-Business functional area may group all requirements for business-to-business 
interactions. This may include all external interfaces to partner and service subscriber 
20 systems. 

An External Data Input functional area may group all requirements for 
incorporating current customer information into the system, such as existing users and 
resources. An Organization Management functional area may group all requirements for 
adding, modifying, and deleting organizations. A Policy Based Provisioning functional area 
25 may group all requirements for defining the provisioning of services based on attributes or a 
users' membership in a role, group, organizational unit, or organization. 

A Report Generation functional area may group all requirements for reporting 
capabilities provided by the system. A Service Management functional area may group all 
requirements for defining services that the system may provision. 
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A System Administration functional area may group all requirements for 
configuring the system. This may include requirements for installing the system and altering 
its configuration parameters. A User Interface Customization functional area may group all 
requirements for providing a user the ability to customize a user interface. A User 
5 Management functional area may group all requirements for adding, modifying, and deleting 
users. 

Other functional areas may be developed based on the needs of the system user. 

System Operation 
Examples of certain operations of the system are shown in the sequence 
10 diagrams of FIGS. 7A-E. FIG. 7A is a sequence diagram of interactions for implementing a 
□ user's authentication to the system. At the conclusion of the authentication, the user is 
m presented with an application interface to perform system actions. In the illustrated 

embodiment, the user is presented an interface to an Organization Management application. 
~f FIG. 7B is a sequence diagram of interactions for adding a user to the system. FIG. 7C is a 

'03 15 sequence diagram of interactions for implementing on-demand provisioning of a service for a 

user. FIG. 7D is a sequence diagram of interactions for synchronizing service data with a 
;f f remote host and enforcing any policies that are violated by detecting changes made on the 

W remote host. 

FIG. 7E is a sequence diagram of interactions for implementing an addition of a 
20 user to the system and provisioning of services for that user based on provisioning policies. In 
embodiments of the present invention, user provisioning is accomplished with the RPM system 
described hereinabove. Unlike RBAC, which provisions users with "soft" resources (such as 
accounts) based on only on roles, RPM provisions users with both "hard" and "soft" 
resources based on policies, which are defined according to user roles and attributes. 
25 Thus, in preferred embodiments of the present invention, the RPM system may 

provision a user with "soft" resources, including, but not limited to passwords, e-mail and 
voice mail accounts, application programs, databases, files, folders, the Internet, Web pages, 
organizational Intranets, and the like. Other, more non-traditional "soft" resources may 
include messages to third parties, digital certificates for enabling the user to access encrypted 
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resources, the capability to order products over the Internet, the ability to order a corporate 
credit card, access to financial services providers, and the like. In addition, RPM may 
provision users with "hard" resources such as telephones, computers, cellular telephones, 
pagers, personal digital assistants, desks, chairs, file cabinets, and other physical components. 
5 RPM may also provide resource bundles, which are pre-packaged groupings of resources that 
are typically provisioned together. For example, a resource bundle may include a cellular 
telephone, telephone service, a pager account, voice mail, and Internet access. Another 
example of a bundled account may be Digital Subscriber Line (DSL) access and an Internet 
Service Provider (ISP) account. 
10 Note that RPM systems according to embodiments of the present invention may 

also have the capability of making provisioning adjustments if a user's roles and attributes 

j «j change, including de-provisioning, and especially de-provisioning all of the allocated resources 

13 j once a user has left the company. 

i»i In preferred embodiments of the present invention, the RPM system provisions 

15 users with resources based on policies, which are defined based on roles and attributes. A role 

'-1} 

Q} describes a person's responsibility within the organization, and may include roles such as a 
manager, secretary, system administrator, committee member, and the like. Each role has 
;if only two values. For example, a user is either a manager (a "yes" value), or he is hot (a "no" 
3* value). An attribute is a characteristic or quality of a user or resource, such as "amount of 
i~= 20 time spent traveling," or "cost." In contrast to a role, each attribute may have multiple 

values. For example, the attribute "amount of time spent traveling" may have the values "less 
than 30%," "between 30% and 60%," and "greater than 60%." 

Policies are written based on these roles and attributes. Because attributes can 
be used in addition to roles to define a policy, the task of defining the relationship between 
25 users and resources is made more efficient. Attributes can take on multiple values, and thus a 
single policy definition can be written in Boolean form using IF-THEN-ELSE IF statements 
(or the equivalent) to account for different attribute values, instead of multiple role definitions 
using IF-THEN statements. It should be noted that although IF-THEN-ELSE statements are 
presented herein for purposes of explanation only, in embodiments of the present invention 
30 any programming language and syntax capable of implementing the equivalent Boolean 
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statements may be employed. A simple example is illustrative. Suppose that a role-based 
system has defined three roles as follows: 



Role No. 


Definition 


1 


IF the user is in marketing AND the user is a manager AND the user travels 
less than 30% of the time, THEN 
provision the user with a pager; 


2 


IF the user is in marketing AND the user is a manager AND the user travels 
between 30% and 60% of the time, THEN 
provision the user with a cellular telephone; 


3 


IF the user is in marketing, THEN 

provision the user with access to the sales figures database; 



Now suppose that a new employee, user A, is a marketing manager that travels 
less than 30% of the time. Suppose also that a new employee, user B, is a marketing manager 
that travels between 30% and 60% of the time. The role-based system would determine that 
roles 1 and 3 apply to user A, and that user A should be provisioned with a pager and access 
to the sales figures database. The role-based system would also determine that roles 2 and 3 
apply to user B, and that user B should be provisioned with a cellular telephone and access to 
the sales figures database. 

Now suppose that a policy-based system according to embodiments of the 
present invention has defined two policies as follows: 
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Policy No. 


Definition 


1 


IF the user is in marketing AND the user is a manager, THEN 
IF the user travels less than 30% of the time, THEN 

provision the user with a pager; 
ELSE IF the user travels between 30% and 60% of the time, THEN 
provision the user with a cellular telephone; 


2 


IF the user is in marketing, THEN 

provision the user with access to the sales figures database; 



The policy-based system of would determine that roles 1 and 2 apply to user A, 
and that user A should be provisioned with a pager and access to the sales figures database. 
The policy-based system would also determine that roles 1 and 2 apply to user B, and that user 
B should be provisioned with a cellular telephone and access to the sales figures database. 

It should be understood from the above example that embodiments of the 
present invention allow a single policy to be defined than covers multiple attribute values, 
minimizing the number of policies that need to be defined as compared to the number of roles 
that would have to be defined in a role-based system. In the simple example provided above, 
policy 1 of the policy-based system replaces roles 1 and 2 of the role^based system. With 
fewer policies to evaluate, less memory may be consumed. In addition, in preferred 
embodiments the determination of resources can be performed more quickly. In the simple 
example provided above, when user A is being evaluated, both IF-THEN statements in roles 1 
and 2 must be evaluated before the role-based system can determine that role 1 applies to user 
A, but role 2 does not. In contrast, once the "IF the user travels less than 30% of the time" 
statement in policy 1 is found to be true, the ELSE IF statement in policy 1 can be bypassed. 

The roles and attributes associated with a user, as described above, may be 
assigned by human resources personnel or other organizational employees prior to the user's 
start date. In preferred embodiments of the present invention, the provisioning of a user may 
be initiated by calling up a provisioning user interface (screen) on a Web browser connected to 
an organizational network. This screen would enable human resources personnel to input 
known roles and attributes. The RPM system would then search its stored policies and, based 



CI 
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on the user's roles and attributes, determine a set of resources to be provisioned. 
Alternatively, human resources personnel may simply type employee information into a human 
resources (HR) system database, where the RPM system would automatically pull information 
from this database through a direct feed and begin the provisioning process. In addition, a 

5 start date or other date and time information may be entered, and the RPM system can initiate 
provisioning tasks when triggered by this date and time information. 

The actual provisioning of resources may involve electronic communications 
and human interaction. For example, an e-mail might be sent to various office personnel to 
deliver a desk and chair to a certain office by a certain date. Another e-mail might be sent to 

10 IT personnel to deliver a computer and telephone to the office by a later date, and then enable 
a computer account, provide access to various applications and databases, e-mail, and voice 
mail by yet another date. Outside procurement services companies may also be contacted for 
some or all of the provisioning tasks. In addition, the provisioning of accounts maintained by 
an external system such as an ASP may be facilitated by communications between the RPM 



4? 15 system and "agent" software that resides in a server within the external system. The "agent" 
Qi acts as a portal through which accounts from the external system may be managed and 



accessed. 

If l Once a user is provisioned with a set of resources, a list of these existing 

01 resources is maintained by the RPM system. Thereafter, if a user's roles or attributes should 

C! 

jl< 20 change, the policies are re-evaluated and a new list of resources to be provisioned are 

determined. This new list of resources is compared to the list of existing resources, and users 
are provisioned or de-provisioned according to the differences in the lists. In preferred 
embodiments, if a particular existing resource is also in the new list of resources, the RPM 
system will make no change regarding this resource, rather than de-provisioning then 
25 provisioning the resource. 

Upon termination or suspension or a user, or if a user should take a leave of 
absence, embodiments of the present invention may also suspend the provisioning of 
resources, rather than de-provisioning them. For example, if a terminated user has threatened 
to take legal action against the company, the user's e-mail account may be suspended but not 
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deleted, so that the user cannot access the e-mail account, but the e-mails may nevertheless be 
reviewed by the company in anticipation of litigation. 

In preferred embodiments of the present invention, a reconciliation process is 
performed when the RPM system is first invoked. In reconciliation, the RPM system 
5 compares a list of currently provisioned resources with a list of resources that should have 
been provisioned based on the current state of each user's roles and attributes. Discrepancies 
between the two lists are resolved by provisioning or de-provisioning. 

Although the previous example described an attribute of a user ("amount of 
time spent traveling"), in embodiments of the present invention the RPM system may also 
10 maintain attributes of resources. Resource attributes play a role where the provisioning 
process allows for a selection of resources. For example, once a user begins working at an 
■CJ organization, the user may be able to call up the provisioning user interface screen to request 

jjj optional resources. After entering additional information, the user may be able to select 

■Sj optional resources, provided that the user has certain attribute values. 

15 Continuing the present example for purposes of illustration only, suppose that 

■OJ user A (a marketing manager that travels less than 30% of the time, and is not automatically 
□ entitled to a cellular telephone) can nevertheless request a cellular telephone if certain other 
Jiff roles and attributes are satisfied. User A may call up the provisioning screen and inter a value 

31 of "Europe" for the attribute "client location." The provisioning screen may then present user 

u 

20 A with a selection of cellular telephones to choose from. If user A selects a cellular telephone 
less than $200, a "bellular telephone cost" attribute having a value "less than $200" will be 
associated with user A, and the system may automatically provision user A with that telephone 
by sending an e-mail order to a cellular telephone provider, for example. 

However, if the selected telephone is more than $200, such as a so-called 

25 "world phone," a "cellular telephone cost" attribute having a value "more than $200" will be 
associated with user A, and approval may be required. For example, an e-mail may be sent to 
a vice-president, providing the vice-president with access to the provisioning screen and 
requesting that the vice-president input the approval or disapproval of the telephone. Once this 
information is provided, the RPM will either order the telephone or send a denial message to 

30 the user. An example policy definition covering this example is as follows: 

015.472852.3 




PATENT 
Docket No: 036258.0207 



Policy No. 


Definition 


1 


IF the user is in marketing AND the user is a manager, THEN 
IF the user travels less than 30% of the time, THEN 
provision the user with a pager; 
IF the user's client's location is in Europe, THEN 
IF the cellular telephone is less than $200 

Provision the user with the cellular telephone; 
ELSE 

approval from a vice-president is needed to provision the user 

with 

the cellular telephone; 
ELSE IF the user travels between 30% and 60% of the time, THEN 
provision the user with a cellular telephone; 



3 

■33 Other examples of resource attributes include, but are not limited to, color, 

-.3 

features, and manufacturer. 
^ 5 As described above, embodiments of the present invention may require input 

j JJ from another person before provisioning can continue. In another example provided for 
W* purposes of illustration only, when a new employee is entered into the system, human 
resources personnel may enter known roles and attributes, such as the new employee's 
department, at which time the policy may halt the inputting of information into the 
10 provisioning screen and instead send an e-mail to the department manager, providing the 

department manager with access to the provisioning screen and requesting that the department 
manager input a cubicle or office location. Once this information is provided, human 
resources personnel are notified, and provisioning of that office with a desk, chair, etc. can 
resume. More generally, at any point in the provisioning sequence, the policy may require 
15 that another person provide some of the new employee's roles, attributes, job descriptions, 
etc. before provisioning can resume. 
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It should be understood that although the above examples describe e-mail as a 
means for seeking information or approval from another person, or ordering resources, other 
methods of communication such as providing hyperlinks to Web pages and automated ordering 
of resources over the Internet using online resource provider order sheets may also be 
5 employed. 

^ As described above, in embodiments of the present invention the provisioning 

process may be a sequence of steps, some of which require human intervention such as 
providing information or authorization. An example of this sequence will now be provided. 
Referring to FIG. 7, a user wishing to be provisioned with one or more resources may access 
10 a provisioning user interface screen 700 from a networked computer. In embodiments of the 
present invention, the provisioning screen 700 may include explanatory text and boxes or 
u fields into which information may be entered. The user may type information into the fields, 
m or may select from a pulldown menu of fixed choices. For example, fields 702 and 704 for a 

user to enter his first and last name may be provided, and a pulldown menu 706 of available 
j ^ 15 resources may be provided. In alternative embodiments, the provisioning screen 700 may also 
o! include fields for optional information, fields for required information that the requesting user 
q does not know (and therefore must be provided by another person), fields for required 
] £i information (such as approvals) that must be provided by another person, and the like. In 

ill 

O! preferred embodiments, however, the provisioning screen visible to the requesting user will 
20 only contain those fields for information that the user is capable of providing. 

Continuing the example of FIG. 7 for purposes of illustration only, suppose that 
the user requests an e-mail account. In embodiments of the present invention, the RPM 
processes the provisioning request by sending the provisioning screen to the manager, sending 
an e-mail to the manager to access a particular hyperlink to view the provisioning screen, or 
25 the like. As indicated by reference character 708, the department manager may see a different 
provisioning screen 708 from the requesting user. For example, the provisioning screen 708 
may include additional fields 710 and 712 which allows the manager to approve or disapprove 
the request, and, if approval is given, which department has given the approval. 

Continuing the example of FIG. 7 for purposes of illustration only, if approval 
30 is given, the provisioning screen may then be made known to the IT department, who may see 
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a different provisioning screen 714 from the department manager. For example, the 
provisioning screen 714 may include an additional field 716 which allows IT personnel to 
designate a particular mail server, which may be dependent on the department information, 
and which may be beyond the department manager's knowledge. 
5 As the preceding example illustrates, in preferred embodiments of the present 

invention, software for controlling the optional provisioning process may establish which 
information is to be provided by an individual, and which individuals have approval or 
disapproval authority, etc. The provisioning process may also determine who can modify 
information, and which information cannot be modified. The provisioning process may also 
10 define what information must be added before the provisioning request can be sent to the next 
person. In alternative embodiments, the provisioning request may be sent back to the 
□ requesting user for additional information or the modification of existing information (i.e. the 

= j 

qj modification of a resource request). In preferred embodiments, the authorizing authority may 

l fl change depending on what is entered into the request fields. Thus, there is no one process 

15 path through which this request form will flow. The process path may actually branch into 

Ill different directions, depending on what information is entered into the fields of the request 

j*i form. A generic name for this flow is called workflow process. 

Cs 

yi System Operation Using a Third Party as an RPM Service Provider 

■O 

u 20 An embodiment of the invention as described up to this point may be shown 

very generally in FIG. 9. A first organization 800 provisions resources (not shown) using a 
first server 802 by interfacing with such resources through the first organization's agents 804. 
Independently, a second organization 806 provisions resources (also not shown) using a second 
server 808 by interfacing with such resources through the second organization's agents 810. 
25 Note that in this configuration, two logical servers, and possibly even more physical servers, 
are being utilized by two independent vendors for the same purpose. Although this 
configuration is typical and may be necessary, it may also be redundant in a variety of 
circumstances. 

An alternative embodiment of the present invention is shown in FIG. 10. Here, 
30 a first organization 800 also provisions resources; however, rather than provisioning resources 
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using a server under its, the first organization 800 may have its resources provisioned by a 
third party RPM service provider operating a third party server 820. The first organization 
800 may interface with the third party server 820 through a network 822, such as, for 
example, the Internet. Likewise, the third party RPM service provider may interface with the 
5 first organization's agents 804 through the network 822 to provision resources for the first 
organization 800. Likewise, the second organization 806 may have its resources provisioned 
by the third party RPM service provider using the third party server 820 through the network 
822. The third party RPM service provider may interface with the second organization's 
agents 810 through the network 822 to provision resources for the second organization 806. 
10 Thus, in this embodiment, both organizations 800, 806 utilize a single logical server 820 
operated and controlled by the third party RPM service provider, 
u According to this embodiment of the invention, both organizations may take 

r]| advantage of the efficiency of a single logical third party server 820 operated by a third party 
Sj over a network 822, thereby removing the costs associated with purchasing and operating a 
j *| 15 server for resource provisioning activities. Also, the third party RPM service provider may 
;JI function as a data center and provide resource provisioning as a managed service to the 
i-i organizations 800, 806, whereby the organizations 800, 806 may become customers of the 
;ff third party RPM service provider. The managed service may be provided on a subscription 
□1 basis, whereby any organization desirous of such services may pay a set periodic fee for all of 
l.[ 20 its resource provisioning needs. 

For example, assume it is the policy of a first company to provide its 
salespersons with an email account and access to its customer database. Assume also that this 
first company has chosen to outsource its resource provisioning requirements to a trusted third 
party RPM service provider. Assume also that it is the policy of a second company to provide 
25 all its employees with an account on its networking operating system, and that the second 

company has also chosen to outsource its resource provisioning requirements to a trusted third 
party RPM service provider. Both companies would provide the trusted third party RPM 
service provider with relevant employee information and the nature of the access rights to be 
granted to the salespersons of the first company and the employees of the second company. 
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Such information could be provided by both companies to the trusted third party RPM service 
provider over a network such as, for example, the Internet. 

The trusted third party RPM service provider may maintain such information on 
its server or servers. This would allow the trusted third party RPM service provider to 
5 immediately provision a new salesperson or new employee with the required resources. All 
that would be required to effect such provisioning would be that each company provide the 
trusted third party RPM service provider with relevant changes to salesperson or employee 
information. Based on such changes, the trusted third party RPM service provider could 
create, change or remove accounts or otherwise modify provisioning on required resources. 
10 Alternatively, each company could provide the trusted third party RPM service provider with 
the exact nature of the provisioning change required. 
Cf A flowchart detailing a method for implementing the embodiment of FIG. 10 is 

■q) shown in FIG. 11 A. A request for provisioning services is received by a third party RPM 

£1 

H service provider at step 830. Such a request may be made by one or more companies needing 
'■^l 15 such services. The request may be made via electronic means or by personal contact between 

Gi the appropriate persons at the company and at the third party RPM service provider. 
•J* j At step 834, the third party RPM service provider receives user information 

;fj from the company making the request. This information may include, but is not limited to, 

Qi user name, user number, a list of resources to which the user will have access, the nature of 

□ 

l = 20 the access rights, and the like. This information may be sent electronically from the customer 
to the third party RPM service provider using a network, such as, for example, the Internet. 
The third party RPM service provider will also receive notification that the user is authorized 
to access the appropriate resources from the customer at step 836. This information may also 
be sent electronically from the customer to the third party RPM service provider using a 

25 network, such as, for example, the Internet. 

At step 838, the third party RPM service provider provisions the relevant 
resource or resources for the user via agents. It should be noted that many systems may be 
provisioned at this step to effect the required provisioning. Such provisioning may also take 
place over a network. Once the resource or resources have been provisioned for the user, the 

30 user is notified accordingly at step 839 and is then at liberty to utilize the resource or resources 
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in accordance with the provisioning policy established by her employer. This process may be 
repeated as many times as necessary for each company making a request to the third party 
RPM service provider for provisioning of its resources. 

A flowchart detailing an alternative method for implementing the embodiment 
5 of FIG. 10 is shown in FIG. 11B. A change in user information is received by a third party 
RPM service provider at step 831. The changes may be received via electronic means over a 
network, such as, for example, the Internet, or by personal contact between the appropriate 
persons at the company and at the third party RPM service provider and may include, without 
limitation, changes in user name, user role, user organization, user title, user location, and the 
10 like. Also, such changes may be received automatically. For example, a mechanism may be 
implemented whereby any changes made to a company's human resources database are 
Si automatically sent to or retrieved by the third party RPM service provider, 
jij At step 832, the third party RPM service provider determines which changes in 

resource access rights are needed based on the user information changes received. This may 
If 15 be done independently of the company sending changes in user information. At step 833, the 
O J third party RPM service provider obtains any approvals necessary for provisioning changes 
r\ prior to effecting such provisioning. 

At step 835, once the necessary approvals have been received, if any, the third 
3? party RPM service provider provisions, which may include, without limitation, 

.=5 3. 
i*. I 

Z[ 20 deprovisioning, the relevant resource or resources for the user via agents. It should be noted 
that many systems may be provisioned at this step to effect the required provisioning. Also, 
resources may be provisioned in parallel. Such provisioning may also take place over a 
network. Once the resource or resources have been provisioned for the user, the user is 
notified accordingly at step 837 and is then at liberty to utilize the resource or resources in 
25 accordance with the provisioning policy established by her employer. 

In the embodiment of the invention shown in FIG. 10, the resources being 
provisioned may all be contained within a customer's "information technology" space. That 
is, the resources being provisioned may not necessarily exist at the customer's site, but may be 
within the realm and under the control of the customer. For example, these types of resources 
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may include, but are not limited to, email, operating systems and databases. Such resources 
may exist worldwide, but, nonetheless, may still be within the control of the customer. 

An enhancement to the embodiment of FIG. 10 is shown in FIG. 12. In this 
embodiment, resources 840 external to the first organization 800 and the second organization 
5 806 may be accessed and utilized by both organizations 800, 806 through a network 822 and 
provisioned for both organizations 800, 806 by a third party RPM service provider using a 
third party server 820. The third party RPM service provider and the organizations 800, 806 
may interface with these resources 840 via agents. 

For example, continuing with the example used in reference to FIG. 10, assume 
10 the first company and the second company provide all of their management level employees 
with a charge card account, such as, for example, an AMERICAN EXPRESS card. Assume 
,! «] also that both companies have also chosen to outsource its provisioning requirements for this 
□I resource to a trusted third party RPM service provider. Both companies would provide the 

a 

q trusted third party RPM service provider with relevant employee information, such as, for 

;j{ 15 example, the names of employees who have management positions within their respective 
■81 companies, the employee numbers of such employees, the charging authority granted to each 
r i individual employee, and the like. Such information may be provided by both companies to 

i ,5 - - - _ _ . 

%\ the trusted third party RPM service provider over a network such as, for example, the 
^ Internet. 

u 20 The trusted third party RPM service provider would then establish the 

appropriate relationship with the charge card company such that the trusted third party RPM 
service provider would have the requisite authority to establish accounts on behalf of the 
companies and provision employees of both companies with charge cards for such accounts 
through agents. Once the relationships between the companies and the trusted third party 

25 RPM service provider, the companies and the charge card company, and the trusted third 
party RPM service provider and the charge card company have been established, the 
provisioning of employees at any of the companies with a charge card account may be 
immediate. All that is necessary is that a company notify the trusted third party RPM service 
provider of its provisioning requirement and supply the trusted third party RPM service 

30 provider with the necessary employee information. The trusted third party RPM service 
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provider can then establish the account with the charge card company and instruct the charge 
card company to forward one or more charge cards to the employee of the company for whom 
the account is being established. 

Another alternative embodiment of the present invention is shown in FIG. 13. 
5 In this embodiment, any number of companies 800, 806 may use a third party RPM service 
provider for provisioning resources through agents 804, 810. These companies 800, 806 may 
utilize their own resources and have these resources provisioned through a network 822, such 
as, for example, the Internet, by the third party RPM service provider using a third party 
server 820. However, these companies 800, 806 may also be considered vendors of their 
10 respective resources and may choose to affiliate themselves with one another and share 
resources. This is easily facilitated due to the third party RPM service provider being a 
] =f common and trusted link to each vendor. Thus, the resources owned and operated by each 
qj affiliate organization may be "cross-provisioned" among the affiliated organizations by the 
J* third party RPM service provider. This embodiment of the invention may also be described as 
l z\ 15 a "resource exchange." 

01 Also, according to this embodiment of the invention, the infrastructure may be 

0 considered semi-private because, although it is not completely private as the enterprise and 
'%[ ASP embodiments described previously are, it is also not completely open to the public. The 

01 infrastructure, and, consequently, the resources available within the infrastructure, may be 

CI 

CI 20 open only to those vendors of resources who have chosen to affiliate themselves with other 
vendors utilizing a third party RPM service provider for purposes of having such resources 
provisioned by such a service provider. 

As an example of the embodiment of the invention shown in FIG. 13, suppose 
that a first vendor belonging to a resource exchange, i.e., belonging to a provisioning 

25 infrastructure, has the capability to provide email systems for other organizations. Suppose 
also that a second vendor in the same resource exchange provides database access to various 
consumer lists. Suppose also that the first vendor determines it has a need for various 
consumer lists and decides it would like to obtain the database information controlled by the 
second vendor. Finally, suppose that the second vendor determines it would like to implement 

30 an email system for its employees. Then, upon notification by each company to the third party 
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RPM service provider, the third party RPM service provider may cross-provision the first 
vendor with the database resource belonging to the second vendor. Likewise, the third party 
RPM service provider may cross-provision the second vendor with the email system provided 
by the first vendor. In this type of cross-provisioning embodiment and others, because the 
5 third party RPM service provider is a trusted authority, it may mask the identity of the an 
employee or employees, which may be original or true identities, by provisioning a "pseudo- 
account" for the second vendor. 

Because both vendors are members of the resource exchange, most, if not all, 
of the information required by the third party RPM service provider for cross-provisioning of 
10 the resources for each vendor will already be available to the third party RPM service 

provider. In addition, both vendors will typically have entered into an agreement regarding 
4j the cross-provisioning of resources, such agreement generally being a condition precedent to 
8 J becoming a member of the resource exchange, the details governing such cross-provisioning 
\r\ will already have been put in place. Thus, the provisioning of the desired resources may be 
^ 15 immediate once the request for provisioning is made. 

0i As another example of the embodiment of the invention shown in FIG. 13, 

r| suppose that an organization in a resource exchange contracts with a charge card company 
m providing that every vice-president in the organization be given access to one of the charge 
;| 3] card company's charge accounts. Assuming that the charge card company is also a member of 
M 20 the resource exchange, as soon as the contract is effective, each vice-president in the 

organization may immediately and automatically be provisioned by the third party RPM 
service provider, through the resource exchange, with a charge card company charge 
accounts. There need be no additional flow of individual information to effectuate the 
provisioning. All information required for the provisioning of the organization's vice- 
25 presidents with charge accounts will already be available on the system, since both the 

organization and the charge card company will have already been members of the exchange. 
However, if desired, additional approval processes may be executed prior to any such 
provisioning. 

Also, the provisioning may be done in the aggregate. Because the organization 
30 will have already identified to the third party RPM service provider its policies for the roles 
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and attributes of persons within its organization, such as those policies applicable to vice- 
presidents, and because the charge card company will have already identified to the third party 
RPM service provider its policies for anyone who needs to be provisioned with one of its 
charge accounts, the third party RPM service provider can coordinate the requirements of both 
5 organizations and expeditiously provision the vice-presidents with charge accounts. 

For example, the organization might have a policy that says vice-presidents get 
an annual spending limit of $100,000. The charge account might be set, then, to limit annual 
purchases for vice-presidents to $100,000. Also, the organization might have a policy that 
says any single purchase by a vice-president cannot be greater than $10,000 without approval 
10 from the president. Thus, the charge account might be set, then, with a single purchase limit 
for vice-presidents of $10,000. So, once a role and its attributes-have been established in the 
4: system, it can immediately be adapted to the provisioning of a resource without further effort 

ijj by the organization. 

£| In this embodiment, a user can also be de-provisioned very quickly. For 

'"I 15 example, assume a vice-president in the organization is terminated or leaves the organization. 
5 J Although her paychecks may stop immediately, her charge account could typically remain 
□ open until the end of the month. This could be very dangerous for the organization in that the 
|SJ vice-president may still have purchasing power on the charge account even though she is no 
fl 1 longer affiliated with the organization. In this embodiment, if the organization tells the third 
£-* 20 party RPM service provider that the vice-president is no longer with the organization, the third 
party RPM service provider can immediately de-provision the vice-president from her charge 
card account, thereby protecting the organization from unauthorized usage. 

A flowchart detailing a method for implementing the embodiment of FIG. 13 is 
shown in FIG. 14A. A request for provisioning services is received by a third party RPM 
25 service provider at step 850. Such a request may be made by one or more companies needing 
such services. The request may be made via electronic means or by personal contact between 
the appropriate persons at the company and at the third party RPM service provider. 
However, in this embodiment the provision request is made for a resource not owned or 
operated by the company making the request. For example, a company might make a request 
30 for email provisioning, but, in actuality, the company might not have an email resource. 
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Accordingly, the company would be looking to an affiliate within the resource exchange to 
provide email services, and would be looking to the third party RPM service provider to 
provision such services. 

At step 854, the third party RPM service provider provisions appropriate 
5 resources within the resource exchange for the company making the provisioning request. 
Once provisioning is complete, the user is notified accordingly at step 856 and is then at 
liberty to use the resource according to the provisioning policy of the company and in 
accordance with an agreement between the company requesting the provisioning of the 
resource and the company providing the resource for provisioning. Typically, such an 
10 agreement would be a condition precedent to becoming a member of the exchange. 

A flowchart detailing an alternative method for implementing the. embodiment 
□ of FIG. 13 is shown in FIG. 14B. A change in user information is received by a third party 
V» RPM service provider at step 851. Such changes may be received by one or more companies 
jit having such changes. The changes may be received via electronic means or by personal 
C-J 15 contact between the appropriate persons at the company and at the third party RPM service 
.0 J provider. Also, such changes may be received automatically. For example, a mechanism may 
%% be implemented whereby any changes made to a company's human resources database are 
jfj automatically sent to or retrieved by the third party RPM service provider, 
m Also, in this embodiment the changes may be for users who are provisioned for 

20 a resource or resources not owned or operated by the company by whom the user is employed. 
For example, a company might have a change for a user with respect to email, but, in 
actuality, the company might not have an email resource. Accordingly, the company would be 
looking to an affiliate within the resource exchange to provide its email services. 

At step 852, the third party RPM service provider determines which changes in 
25 resource access rights are needed based on the user information changes received. This may 
be done independently of the company sending changes in user information. At step 853, the 
third party RPM service provider obtains any approvals necessary for provisioning changes 
prior to effecting such provisioning. 

At step 855, the third party RPM service provider provisions, which may 
30 include, without limitation, deprovisioning, appropriate resources within the resource 
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exchange for the company providing changes in user information. Provisioning of multiple 
resources may be done in parallel. Once provisioning is complete, the user is notified 
accordingly at step 857 and is then at liberty to use the resource or resources according to the 
provisioning policy of the company and in accordance with an agreement between the 
5 company requesting the provisioning of the resource and the company providing the resource 
for provisioning. Typically, such an agreement would be a condition precedent to becoming a 
member of the exchange. 

Billing for cross-provisioning services among affiliates may take a variety of 
forms. For example, a transaction fee may be applied by a vendor each time a resource is 

10 provisioned. Such fee may be payable to the customer requesting provisioning to the vendor 
of the resource, with a percentage of such fee payable to the third party RPM service 
provider. Alternatively, a subscription may be paid by a customer requesting provisioning to 
the vendor of a resource such that all provisioning fees are included in the subscription rate. 
This type of billing arrangement may be attractive to a customer with heavy provisioning 

15 needs if such needs can be anticipated. 

Various techniques to facilitate the cross-provisioning of resources among 
affiliates may be included, without limitation, in the embodiment shown in FIG. 13. For 
example, to facilitate cross-provisioning of resources in a resource exchange, a "footprint" of 
the roles and attributes within each affiliate organization in the exchange may be made 

20 generic. That is, each role within one affiliate organization may translate to a corresponding 
role in another affiliate organization. This may be made possible by a translational map that 
translates roles from one affiliate into another. For example, a sales engineer in one affiliate 
may be referred to as a technical sales consultant in another affiliate. Even though these two 
positions may be identified differently in their respective organizations, the duties required by 

25 the positions may be the same in the context of the exchange. Thus, the third party RPM 
service provider may maintain a translational map that coordinates the access rights and 
entitlements of these two positions between affiliate resources. So, a sales engineer in a first 
affiliate may have the same entitlement to resources as a technical sales consultant in a second 
affiliate and vice versa. The third party RPM service provider may provide a mapping to 

30 standard affiliate organizational footprints or standard policies. 
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Another technique used to facilitate the cross-provisioning of resources among 
affiliates in the embodiment shown in FIG. 13 relates to high level authentication of affiliates. 
Success of an affiliate resource exchange may, require that each affiliate be authenticated with 
respect to various business and financial aspects of such affiliates, including, without 
5 limitation, background checks, credit worthiness checks, cash flow checks, and other aspects 
of an affiliate's business and financial viability. Such high level authentication may be 
performed by the third party RPM service provider and used in addition to an authentication of 
identity provided by various techniques including, but not limited to, passwords and 
multifactor approaches such as PKI and biometrics. 
10 Yet another technique used to facilitate the cross-provisioning of resources 

among affiliates in the embodiment shown in FIG. 13 relates to identity synchronization. In 
C| order for cross-provisioning of resources to function smoothly in a resource exchange, updated 
m information regarding resource users and affiliates within the exchange must be readily 
|= J available. For example, should an affiliate leave the exchange, this must be reflected as soon 
if 15 as possible within the list of resource exchange affiliates so that other affiliates may plan and 
Ql take action accordingly, especially if the departure of an individual means exposure to loss for 
□ a critical resource of another affiliate. Conversely, should an organization providing a 
'i: valuable resource or resources become a member of the exchange, such information should 

3* also be made available to other affiliates of the exchange so that they may readily take 

O 

| = b 20 advantage of the additional resource or resources available. Such a resource or resources may 
be registered in the exchange and provisioned accordingly by the third party RPM service 
provider. 

A third party RPM service provider may provide such identity synchronization 
within the resource exchange. Such synchronization is made possible from a practical 
25 standpoint due to the fact that the third party RPM service provider may function as a data 
center for all affiliate members of the resource exchange. Thus, all information required to 
update resource exchange information is available on one logical server and updates can, 
therefore, be made quickly and efficiently. 

Yet another technique used to facilitate the cross-provisioning of resources 
30 among affiliates in the embodiment shown in FIG. 13 relates to audit trails. It may be 
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advantageous for security, accountability and other reasons for each affiliate of the resource 
exchange to have a record of each cross-provisioning transaction completed for its own 
resources by the third party RPM service provider. Moreover, it may also be advantageous 
for each affiliate of the exchange to have a record of each cross-provisioning transaction 
5 completed for its users of another affiliate's resources. A third party RPM service provider 
may provide an audit trail, i.e., a record of each provisioning transaction, for affiliates of the 
resource exchange. Such an audit trail may be implemented by a third party RPM service 
provider since, as before, a third party RPM service provider may function as a data center for 
all affiliate members of the resource exchange. Thus, all information regarding provisioning 
10 transactions may be easily recorded and provided to affiliate members at their request. 

Yet another technique used to facilitate the cross-provisioning of resources 

0 among affiliates in the embodiment shown in FIG. 13 relates to anonymity of individuals and 
?3l organizations interacting with resources. In the event resource usage within a resource 

q exchange is subject to interaction, such as, for example, bidding, identities of the affiliates 
15 involved in such interaction may be made anonymous during the interaction process. That is, 

01 during such interaction, affiliate identities may be masked out so that the interaction process is 
£i not skewed by the identity of the affiliates. 

*£[ There may be three levels of anonymity implemented in a resource exchange. 

Qi First, there may be no anonymity at all. Using bidding as an example, it may be unimportant 

20 to the affiliates that their identities remain anonymous during a bidding process. 

Consequently, their identities may be made known to the other affiliates bidding on a resource. 
Second, the identities of affiliates bidding on a resource may be masked out, but a user doing 
the actual bidding may be assigned some type of unique identifier to be used for all bidding 
sessions. Third, the identities of affiliates bidding on a resource may be masked out and a 

25 generic identifier used for only one bidding session may be assigned to a user doing the actual 
bidding; at subsequent bidding sessions, a different generic identifier may be assigned to the 
same user doing the actual bidding. Such anonymity may be facilitated by a third party RPM 
service provider since a third party RPM service provider functions as a centralized provider 
of provisioning services for all affiliate members of the resource exchange. Thus, identities of 
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the affiliates may be masked at the discretion of the affiliates by the third party RPM service 
provider, such identities remaining anonymous if an affiliate so chooses. 

Another alternative embodiment of the present invention is shown in FIG. 15. 
In this embodiment, any individual organization of the general public 860 may use a third 
5 party RPM service provider for provisioning resources, as opposed to vendors providing 
resources that are provisioned for affiliate use in a resource exchange. Here, the third party 
RPM service provider provides the infrastructure to allow any individual organization of the 
general public requiring provisioning services to obtain such services, thus providing a public 
provisioning infrastructure. This configuration supports customers without resources to utilize 
10 the resources of a resource exchange or other external resources that are part of a public 
provisioning infrastructure. 
O To effect the embodiment of the invention shown in FIG. 15, the third party 

iii RPM service provider may provide any individual organization of the general public 860, 
i** which includes, without limitation, users, organizations and affiliates, with a "ticket" 
! ~f 15 subsequent to the verification of the user's identity. The "ticket" may associate the user with 
oj entitlement, policies, attributes, roles and rules in connection with the provisioned resources. 

■2 

gi An organization may have, for example, an "organizational footprint" that defines which of 
%{ the positions in an organization are entitled to various resources and also defines the level of 
31 access to and utilization of those resources to which the particular position is entitled. For 
j~L 20 example, if a person in an organization is a salesperson, the ticket may give the salesperson 
access to every resource to which the salesperson is entitled based on the rules defined in the 
organizational footprint. So, for example, if someone obtains a ticket, that person gets 
footprint access into the resources of the infrastructure, or the resource exchange, made 
available to it by virtue of the footprint, ticket and the authenticity of the user's identification. < 
25 Tickets may be authenticated and verified by a trusted third party RPM service 

provider. Attributes for tickets may vary widely. A ticket may be transferable, it may exist 
for a specific length of time, or it may have various access rights associated with it. A ticket 
may exist for one person, several persons, or an entire organization. For example, suppose a 
law firm has a need to use a resource such as an information database. Assume that the law 
30 firm enters into an agreement with the information database resource provider and also enters 
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into an agreement with a trusted third party RPM service provider to provision its employees 
with access to the database. Then, the trusted third party RPM service provider will generate 
a ticket for such access. Each lawyer in the firm would then get a ticket for access to the 
database in accordance with firm policy. Alternatively, the entire firm may receive one ticket 
5 for access to the database. The ticket may be good for a set period of time and may provide 
each attorney with certain access rights with respect to the database. At the end of the set 
period of time, the law firm may analyze usage and cost associated with the database and 
modify the access rights on the ticket. 

Continuing with this example, assume a new attorney joins the law firm. 
10 Because the law firm has already entered into an agreement with the third party service 
provider to provision its attorneys with the database, and because the law firm has already 
! "- 5 entered into an agreement with the database resource provider to utilize the database, all the 
'91 law firm need do to provision the new attorney with database access is to provide information 
vfj to the third party RPM service provider indicating that a new attorney has joined the firm and 
~f 15 provide the third party RPM service provider with relevant information regarding the new 

attorney. Because resource providers are provided with tickets, the third party RPM service 
ri provider will then generate a ticket and send it to the database resource provider. In turn, the 
database resource provider will set up an account for the new attorney. The new attorney may 
9> : then access the database, subject only to authentication of her identity by PKI or another 
u 20 identity authentication method. 

A flowchart detailing a method for implementing the embodiment of FIG. 15 is 
shown in FIG. 16. A request for provisioning services may be received by a third party RPM 
service provider at step 870. Such a request may be made by an individual organization in the 
general public needing such services. The request may be made via electronic means or by 
25 personal contact between the appropriate persons at the organization and at the third party 
RPM service provider. At step 872, the third party RPM service provider allocates 
appropriate space on its server to accommodate the data processing needs of the organization 
making the service request. 

At step 874, the third party RPM service provider receives user information 
30 from the organization making the request. This information may include, but is not limited to, 
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user name, user number, a list of resources for which the user desires access, the nature of the 
access rights, and the like. This information may be sent electronically from the organization 
to the third party RPM service provider using a network, such as, for example, the Internet. 
The third party RPM service provider will then provision the user with the requested resources 
5 at step 876. Once the user has been provisioned with the resources, the user is at liberty to 
use such resources pursuant to agreements entered into between the third party RPM service 
provider and the individual organization and the resource provider and the individual 
organization. 

The embodiment of FIG. 15 may be likened to a hub and spoke configuration, 
10 wherein the third party RPM service provider is the hub and groupings of affiliations or 
individual organizations in the general public exist at the end of each spoke. In this 
j ™ J embodiment, all levels of access may be permitted within the confines of the public 
ii| provisioning infrastructure. For example, assume that a non-computing resource such as a 
□ charge card account exists within a resource exchange of affiliated companies. If an individual 
!"f 15 organization in the general public who is not a member of the resource exchange desires to be 

'is J 

j 3l provisioned with such charge accounts, it may enter the infrastructure by requesting that a 
i:| trusted third party RPM service provider generate a ticket for it that provides it with access to 

is! ' ~ ■ - 

%i the charge accounts in the exchange. 

■8| A graphical diagram showing various levels of embodiments of the present 

j«b 20 invention is shown in FIG. 17. At the central location provisioning level 880, various 
organizations 881 may obtain resource provisioning from a third party RPM resource 
provider. At an affiliate level 882, various resource vendors 883 may be part of a resource 
exchange, sharing resources with other affiliates 883 within the exchange. At a public 
provisioning infrastructure level 884, an individual organization 885 may obtain access to 
25 resources within the infrastructure, subject to receipt of a provisioning ticket and appropriate 
identity authentication. 

The embodiments shown in FIGS. 9-17 may be used in connection with a public 
key infrastructure (PKI), i.e., an infrastructure providing identification authentication and 
certificates. Using PKI, the identity, privacy and nonrepudiation of users of embodiments of 
30 the present invention, which includes, without limitation, companies, organizations, vendors, 

015.472852.3 




PATENT 
Docket No: 036258.0207 



-53- 



and affiliates, as well as members of the general public, may be assured. Once an identity is 
assured by PKI, provisioning of a resource for a user may occur. A provisioning 
infrastructure may be coupled with a PKI such that identity is authenticated and resources are 
provided based on the identity and the relationship between the identity and the provisioning 
5 policy of an organization making a resource available to a user. PKIs are well known in the 
art and will not be described in detail here. Although PKI may be part of the infrastructure 
utilized by a third party RPM service provider when providing its provisioning services, it 
may also exist as a provisionable resource within a resource exchange or a public provisioning 
infrastructure. 

10 While the invention has been described with reference to its preferred 

embodiments, those skilled in the art will understand and appreciate from the foregoing that 
variations in equipment, operating conditions and configuration may be made and still fall 
within the spirit and scope of the present invention which is to be limited only by the claims 
appended hereto. 



] z: 15 



015.472852.3 



